Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-47860

Unbounded decompression of attacker-supplied compressed message bodies

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring AMQP

Default version status: unaffected

  • 4.1.0affected
  • 4.0.0 to ≤ 4.0.4affected
  • 3.2.0 to ≤ 3.2.12affected
  • 0 to ≤ 2.4.18affected

References